CC359

You are not alone. I'm at a small school so I took the initiative to do the research, carry out audits, make records, propose changes in school operations, and re-wrote or created some policies from scratch, and have simply been emailing updates to the SLT as I've gone along. I've been at it for a year so colleagues eventually realised what I was doing and why it was important. Nobody here would've had the time to do it otherwise and I get the impression that in most places people hear the word "data" and just assume it's an IT issue. I believe my school has also bought into your LA's DPO service so I'm waiting to see what they can actually do for us when a situation happens where the school calls on their support - advice on something legal, or a data breach, etc.

I came across this PDF a while ago, I hope it might be helpful. http://2040training.co.uk/wp-content/uploads/2017/12/DPO-Guide.pdf

I see, thanks for clarifying An up to £10 charge was allowed under the DPA to cover postage/printing costs, if I'm right? So under GDPR there is no charge allowed to be made whatsoever?

Requests that are deemed "unfounded and excessive" can be denied. The problem is that these guidelines are all considered on a case-by-case basis and people will have different opinions on the definitions. A̶s̶ ̶f̶a̶r̶ ̶a̶s̶ ̶I̶ ̶k̶n̶o̶w̶ ̶s̶o̶m̶e̶t̶h̶i̶n̶g̶ ̶t̶h̶a̶t̶ ̶t̶a̶k̶e̶s̶ ̶l̶o̶n̶g̶e̶r̶ ̶t̶h̶a̶n̶ ̶1̶8̶ ̶h̶r̶s̶ ̶a̶l̶l̶o̶w̶s̶ ̶t̶h̶e̶ ̶£̶2̶5̶ ̶p̶e̶r̶ ̶h̶o̶u̶r̶ ̶c̶h̶a̶r̶g̶e̶,̶ ̶s̶o̶ ̶i̶f̶ ̶a̶ ̶s̶c̶h̶o̶o̶l̶ ̶f̶i̶l̶l̶i̶n̶g̶ ̶o̶u̶t̶ ̶y̶o̶u̶r̶ ̶f̶o̶r̶m̶ ̶t̶a̶k̶e̶s̶ ̶2̶5̶ ̶h̶r̶s̶ ̶t̶o̶ ̶d̶o̶ ̶s̶o̶ ̶a̶n̶d̶ ̶r̶e̶q̶u̶e̶s̶t̶s̶ ̶y̶o̶u̶ ̶t̶o̶ ̶p̶a̶y̶ ̶t̶h̶e̶ ̶f̶e̶e̶,̶ ̶w̶o̶u̶l̶d̶ ̶y̶o̶u̶ ̶b̶e̶ ̶w̶i̶l̶l̶i̶n̶g̶ ̶t̶o̶ ̶d̶o̶ ̶s̶o̶?̶ I suspect your first reaction to that is that it shouldn't take longer than 18 hours and you question the competency of the school. You might also feel like they took so long in order to spite you. We can't know. If you come up with a different way of submitting the request however, I see that as progress. They've given you feedback, you've listened and acted accordingly, and they may feel much more amicable towards you. Win-win all around. If you still feel like certain LAs and schools are being needlessly difficult after you've made an effort to accommodate them, then you should report it to the ICO. I personally don't have issues with the form you provided and will be happy to fill it out if given the green light by the ICO, and if the admin staff have misplaced the email in the lapsed time since we received it, then I will contact you to re-send it. But I haven't been impressed with the tone and condescending attitude you've used on these forums. If I were in your shoes, where a FOI request I sent out ended up creating so much discord, I would have publicly collected and acknowledged feedback to show that I am receptive and listening, even if I disagree with the feedback given. There isn't a need for things to have become as aggressive as they seem to have done. Edit: Crossing out mis-information

Headache of pedantics going on here. @bmaloney I understand that you've put a lot of thought and time into creating a form to collect the data you need as efficiently as possible, but I believe that what you're encountering is the fact that, as far as I know, schools are chronically understaffed concerning administrative matters. And they're understaffed in this area because of a lack of funding. Admin staff are just not viewed as important in the grand scheme of things, even though they're critical to making a school actually function. I guess the school I work at is lucky to have me as a tech, because I willingly take on work that's not officially my responsibility. Anything the overworked and stressed admin staff cannot handle is delegated to me. For the past year or more I've assumed full responsibility over everything data protection, and that includes subject access requests. Even if schools want to comply, the form is large and intimidating. The office staff and Head at this school were daunted by it, even though they have me available to comb through the data and complete it for them. After consulting other local Heads, whose schools were also daunted by the request (and at the time were waiting to hear back from our LA who had contacted the ICO), this Head decided they didn't want me spending the time on it when there are so many other things that need to be done. The ICO then deemed the request invalid, so I didn't have to do it. You have challenged their decision, so here I am waiting to see what the outcome is. I get that you're frustrated at what looks like incompetence from the schools. It's true that some might be too quick to dismiss the request. But the only reason they'll be avoiding it is because they don't feel like they have the time to complete it. The least you can do is consider schools' situations, and openly listen to their feedback. Friendliness and co-operation goes a long way to achieving results, rather than being defensive and taking everything personally. Don't try telling schools how you think they should be running or doing things if you only have an outside perspective. I too get frustrated at fumbling inefficiency, and what looks like people avoiding responsibilities/workload, (and I have an inside view), but I also understand why things come across as they do. The 3 years I've been working in education have opened my eyes a lot and taught me to be a little more patient and considerate.

Planning to publish/distribute all updated policies and notices on 25th of May over here. Just makes it simpler to publicly prove that we are aware of law changes and have acted accordingly to ensure compliance, regardless of how harshly or softly people view the deadline.

The head here initially rejected this request, as did every other head they spoke to, as far as I know. It was certainly large but I was happy to put the time into completing it if necessary. I'm also interested in the result of the appeal.

My school will continue using it. It's become quite integral and Google have been transparent about being GDPR compliant.